(01-10-2014, 08:30 PM)Raz Wrote: Petie and I use MySQL Workbench when connecting to the MySQL server. Of course the server itself isn't public facing and we need to tunnel in for security purposes but basically with MySQL Workbench it's as easy as right clicking and selecting Truncate as Petie said.

(01-11-2014, 09:05 AM)Phaze Wrote:

(01-10-2014, 08:30 PM)Raz Wrote: Petie and I use MySQL Workbench when connecting to the MySQL server. Of course the server itself isn't public facing and we need to tunnel in for security purposes but basically with MySQL Workbench it's as easy as right clicking and selecting Truncate as Petie said.

Hm... you know, this post got me thinking. After futzing about for a while and deciphering the mysterious runes inherent in "ssh user@server -L sourcemysqlport:localhost:servermysqlport" I managed to replicate a tunneling setup. I guess I can get rid of phpMyAdmin (one less potential hole to worry about!) now! Thanks, Raz

(01-11-2014, 09:19 AM)Raz Wrote: Good. That's exactly the way it should be. PHPMyAdmin isn't so bad so long as it's running on the server side and you're not exposing MySQL to any external network traffic but even security is paramount and so SSH with RSA keys is the way to go.

(01-12-2014, 02:18 AM)Phaze Wrote:

(01-11-2014, 09:19 AM)Raz Wrote: Good. That's exactly the way it should be. PHPMyAdmin isn't so bad so long as it's running on the server side and you're not exposing MySQL to any external network traffic but even security is paramount and so SSH with RSA keys is the way to go.

Server side? I thought the risk inherent in phpMyAdmin was if it was on a site since it's vulnerable to attack at times, especially if outdated. Wouldn't it make more sense if it was on another server that is having its connection tunneled through to the server with the database on it via SSH?

I still use a password to SSH into my box instead of RSA keys but I'd like to believe the password is reasonably secure to make bruteforce infeasible.

(01-12-2014, 11:55 AM)Raz Wrote: PHP is PHP no matter where it's hosted, putting it on a remote server and tunneling the information back to the MySQL server and having the MySQL server on the same box as PHP have the exact same risks. PHPMyAdmin will connect to the same MySQL server regardless of where it's sitting so the risk is no more or less for it being installed locally, indeed the preference for it being local is to reduce data transaction latency since it won't have to tunnel to send/receive any data.

SSH with RSA keys just means you can automate a lot of the work, indeed we automate a lot of processes such as offsite backups and RSA keys means there's never any passwords lying around.

(01-12-2014, 10:37 PM)Petie Wrote: You need SSH access for offsite backups. We do use cron jobs to automate backups but to copy those backups to another server, you need to be able to access it.

Also, I love that 512 was a milestone for you.

(01-12-2014, 08:41 PM)Phaze Wrote:

(01-12-2014, 11:55 AM)Raz Wrote: PHP is PHP no matter where it's hosted, putting it on a remote server and tunneling the information back to the MySQL server and having the MySQL server on the same box as PHP have the exact same risks. PHPMyAdmin will connect to the same MySQL server regardless of where it's sitting so the risk is no more or less for it being installed locally, indeed the preference for it being local is to reduce data transaction latency since it won't have to tunnel to send/receive any data.

SSH with RSA keys just means you can automate a lot of the work, indeed we automate a lot of processes such as offsite backups and RSA keys means there's never any passwords lying around.

PHP is PHP, yes... but it's a lot harder to exploit an insecure PHP client when you don't even know it exists or where it exists, especially if it's not running all the time and is inaccessible from behind a Router. If it's on the server, all you gotta do is compromise the software to gain PHP-level-access to the server! Then you have an attacker who effectively has access to any DB you're currently using in forums etc. on the same HTTP server.

Couldn't you just cron shellscripts for automation or do you need SSH access for stuff like backups?

(01-13-2014, 03:36 AM)tigerlily Wrote: Dazz made me read this out loud to him. What. Techno-babble!

(01-13-2014, 03:08 AM)Raz Wrote: My preference is running it and changing the alias to something that is not /phpmyadmin or /pma. I would also use fail2ban to pick up any brute force attempts and IP ban clients that are caught doing so, the same system I use to ban SSH and webmail brute force attempts.

(01-13-2014, 05:58 AM)psychospacecow Wrote: Is web design just a bunch of acronyms?

(01-13-2014, 06:47 AM)psychospacecow Wrote: Heck, I can't memorize the instructions to make a bowl of ramen without checking twice. I got to give you guys kudos if nothing else.